Security Transparency
Leadership should not need spreadsheet archaeology to see security posture.
Training completion, security assessments, risk levels, staffing and asset context lived in Excel, APIs and local Streamlit apps. Refresh was manual; there was no reliable source of truth for BI.
I took the domain from prototypes to a scheduled fetch → transform → publish pipeline:
- Sources: security-training platforms, assessments and risk levels, tracker data, staffing, production catalogue, drop-zone files.
- Fact tables in Parquet, aligned to the organisation’s agile hierarchy (line → value stream → team).
- Object storage + catalog + SQL + scheduled dashboards. Separate schedules per domain (e.g. assessments weekly vs training).
- Fail-closed: a failed fetch does not publish garbage.
- CI runners reach cloud via OIDC → IAM (short-lived credentials, no keys in the repo).
What came before
Earlier Streamlit products for training KPIs and assessment reporting seeded the data model: joins on identity, filters by organisational unit and agile hierarchy, PDF export, fake datasets so development never needed production PII. Those apps still serve teams; the scheduled pipeline is what leadership actually refreshes.
Stack
Python · pandas/Parquet · GitLab CI · object storage · Glue/Athena-style SQL · BI dashboards · OIDC.
Internal Swisscom product — no public repository. Internal platform names omitted.